Support Verification#

Decision#

Survey owns a SupportVerifier port and an immutable CandidateVerification record. The record says what an identified verifier said about one candidate's value and evidence. It is not a trust decision. Nothing in Survey routes, auto-accepts, or calibrates on it, so a record can never upgrade a candidate. The one derivation that reads records is the descriptive unsupported field content state (see Field States and Carry-Forward), which can only mark a field as lacking support and never changes a claim's status. Survey ships no verifier implementations. Deterministic producer-side annotations stay with the producer, and model adapters live in separate packages, as the producer-profile decision already requires.

A verifier's failure is recorded as an abstention with a reason (error, empty, malformed, timeout), never as a pass or a fail. score is optional, never defaulted, uncalibrated unless a calibration record says otherwise, and never feeds confidence or conclusionConfidence.

Choices the issue left open#

• Where records ride. On ReviewCandidate.verifications, the candidate the decision surfaces read. SurveyInput candidates do not carry them yet, because the only reader there would be the Surface projection, which is a separate change.
• Inputs digest. Besides valueDigest (the Surface-compatible value binding), each record carries inputDigest over everything the verifier was given. The fold checks it only when the caller supplies the evidence. The decision surfaces do not, so on those surfaces a record binds by candidate and value.
• Verifier method on the port. method is declared by the verifier, not per call, so one verifier identity cannot report mixed methods.
• Score range. A score must be a finite number from 0 to 1. Anything else is a malformed verdict.
• Empty evidence. An input with no evidence is a caller error and throws. It is not recorded as an abstention.
• Status vocabulary. The fold's status is not-evaluated (no valid record applies to the current value), abstained (records apply, but every one is an abstention), or evaluated (at least one applicable record carries a supported, contradicted or not-addressed verdict). A separate abstained keeps a verifier that only failed from reading as a check that ran. There is no aggregate verdict.
• Timeout. runSupportVerifier always bounds the wait: DEFAULT_SUPPORT_VERIFIER_TIMEOUT_MS (30 seconds) unless the caller passes timeoutMs. A verifier that hangs records abstain/timeout. timeoutMs may not exceed MAX_SUPPORT_VERIFIER_TIMEOUT_MS (2_147_483_647 ms), since a timer clamps a larger delay to 1 ms.
• What validation proves. Reload validation catches edited and inconsistent records: the id is a content digest, not a signature, so it does not establish who wrote a record. A record rebuilt with a recomputed id validates.
• What reviewers see. Verifier, version, method and result (or abstention reason) for each applicable record, labelled as what a verifier said, not proof and not a review decision. Counts of records that do not apply and of records that failed validation follow. The score is not shown, because it is uncalibrated.